Public Storage Buckets

What Is Public Storage Buckets?

Object storage buckets are named, not hidden, and scanners walk name patterns all day. A bucket set to allow anonymous read is a public website you did not know you published. You'll find a bucket name on a public support page, list its contents, and pull a nightly customer export in one unauthenticated request. Then you'll turn on Block Public Access account-wide and replace the wildcard policy with one naming who may read. Closing the bucket does not un-download what already left.

What You'll Learn in Public Storage Buckets

• Bucket names are guessable and scanned continuously. Obscurity is not access control.
• Anonymous read on a bucket holding an export is a complete breach in one request, with no rate limit to slow it.
• Fix at the account level with block-public-access, not just on the one bucket that was found.
• Prove the fix by re-running the identical anonymous request and confirming it is denied.

Public Storage Buckets — Training Steps

1. A host in a support page

   Bob is targeting Orbrandt, a company whose software runs the appointment books and client records of several hundred veterinary practices. He has no credentials and no foothold, and he is not looking for one yet. He starts where anyone can: the parts of the company that are meant to be public.

2. Allowlist this host

   The page is exactly what it claims to be: printable consent forms and import templates for clinics. Useful, dull, and entirely intended to be public. One support note on it is more interesting than the forms.

3. Ask it for a list

   A bucket that serves files is one thing. A bucket that will enumerate its own contents to a stranger is another, and the two are separate permissions that people routinely grant together by accident. Bob asks for the listing with no credentials at all.

4. What is in exports

   The forms prefix is the one the company meant to publish. Bob goes straight past it.

5. A website nobody published

   The command line is Bob's habit, but it is not required. The same permission answers an ordinary browser, which is worth seeing, because it is how this kind of exposure is usually found by someone who was not even looking.

6. No login, no key, just a URL

   No credential was offered and none was asked for. The bucket returned its own index to an anonymous browser.

7. Take a copy

   Listing a bucket tells an attacker what exists. Reading from it is a separate permission, and Orbrandt granted that one too.

8. What was in it

   Up to now this has been file names and byte counts. Bob opens the top of the file to see what he actually took.

9. Why it worked

   Bob closes the laptop with a copy of every client record Orbrandt holds.

10. Someone else found it too

    Nine days pass. Nobody at Orbrandt notices anything, because an anonymous read leaves nothing in an inbox to notice. Then a researcher finds the same bucket and does the responsible thing with it.